Consumer Health Data Privacy Notice

Who we are

IBDHealth is the entity responsible for the consumer health data described here.

Questions, requests and appeals: contact@ibdhealth.io.

What consumer health data we collect

All of it is data you enter or upload, and all of it is about your inflammatory bowel disease or the life you live around it:

• Bowel movements, including their characteristics and timing.
• Meals and the foods in them.
• Medications and the doses you take.
• Symptoms, sleep, and daily check-ins.
• The dietary approaches you follow.
• Laboratory results, and the lab reports you upload. Examination reports you upload, including colonoscopy, MRI and bowel-screen reports.
• Your diagnosis, your date of diagnosis, your date of birth, and your smoking status.
• Your email address, and the country you tell us you are in.

Where it comes from

From you, directly, with one exception we would rather name than have you find. If you have not chosen a country, the app fills that field in from the country your internet connection appears to be in, and shows it to you in a control you can change. It is a starting answer for a form field, not a finding about where you are.

We do not buy data about you, we do not obtain it from any other source, and we do not track you across other websites or apps.

Why we collect it

To show you your own history and trends, and to produce a report you can take to a clinical appointment. That is the whole purpose. We do not use it for advertising, we do not profile you, and nothing in this product predicts or diagnoses anything.

Who we share it with

Three service providers, each under a written contract that permits them to act only on our instructions, and no one else:

Your data is stored in Belgium (Google Cloud europe-west1). Having a model read an uploaded report is off unless you switch it on, separately from every other agreement, and you can switch it back off without losing your account.

We do not sell your consumer health data

We have never sold it. There is no advertising on this product, we do not collect anything for advertising purposes, and there are no third-party analytics, tracking or advertising scripts anywhere on this site.

Your rights

You may, at any time:

• Withdraw your consent — to processing generally, or to any single purpose such as a model reading an uploaded report, without withdrawing the others.
• Confirm whether we hold or share your consumer health data, and see it — the export on your account page returns the whole record.
• Obtain the list of third parties it has been shared with. That export includes a disclosures record: the service providers above, plus a dated entry for every document of yours that was actually sent to a model. It answers what left and when, not merely who might have seen it.
• Have it deleted — see below for exactly what that does and when.

Exercise any of these from your account page, or by emailing contact@ibdhealth.io. If we refuse a request, you may appeal by replying to our response; a person reviews it and answers you in writing. You may also complain to the Washington Attorney General.

How long we keep it, and what deletion does

We keep your data while your account is open. When you delete your account you are locked out immediately, and your record — every event, every uploaded document, your profile — is erased 7 days later by a job that runs every night.

The 7-day gap is deliberate and it is for your protection, not our convenience: erasure that is instant and irreversible would make destroying your entire medical history the most damaging thing an account takeover could do.

Two things survive, and we would rather say so than let you discover it. A record that the erasure happened, and the record of what you consented to, both stripped of anything identifying you — an audit trail a deletion request can destroy is one an attacker can destroy by asking to be deleted, and consent records are the only way to answer a later complaint that we processed data with no basis.

Database backups are retained for 7 days, so an erased record can persist in a backup for up to that long before it ages out. We disclose this rather than edit backups selectively, because a backup that has been surgically altered is no longer a reliable backup of anyone’s data.

Changes to this notice

This notice carries a version, shown at the top. If we change it materially we will ask for your agreement again rather than assume it.

The rest of the picture

This notice covers consumer health data specifically. The general privacy notice covers everything else — our legal basis, security, how long individual records live, and the rights that come from European law, which apply to your data too because that is where it is stored.